Privacy Policy Dysferlin Registry

Goals of Our Dysferlin Registry and Overview of Our Privacy Policy

The goals of our website, https://dysferlinregistry.jain-foundation.org (the “Dysferlin Registry Site”), are twofold. We intend to create the premier international registry of patients in order to prepare for successful clinical trials and we intend to provide an interactive community for those patients who wish to share certain information with other patients.

Patient Registry

The first goal of the Dysferlin Registry Site is to house an international registry of patients, which we refer to as the “Registry”. The Registry will include patients who have been genetically diagnosed with either Limb Girdle Muscular Dystrophy Type 2B (LGMD2B) or Miyoshi Myopathy (MM), as well as parents, legal guardians or caregivers of such patients, and employees of the Jain Foundation. We believe that the Registry will be an essential tool towards achieving approved therapies and cures for this disease, as it will contain data that is necessary to facilitate the development and commercialization of effective therapeutics by academic and industry participants as well as data that will help us identify patients who might be suitable for participation in clinical trials or who might benefit from a particular therapy once approved. The data will include, for example, the number of confirmed patients throughout the world, which types of mutations each patient has, the age of onset of symptoms as well as when each patient was diagnosed, and other relevant information. We will gather such data for the Registry through the process of member registration as well as through surveys that we will circulate to our Members. We also gathered some of this data from those of you who became members of our prior registry and provided your consent to use that data.

The data and information that we collect for the Registry will only be accessible to the Jain Foundation’s employees and contractors, who play a role in the function of the Registry and will be bound by written obligations of confidentiality. We may, however, share aggregated (and therefore de-identified) Registry information with pharmaceutical companies, hospitals, universities, research institutions and similar entities involved in the research, development and commercialization of potential therapeutics and cures for rare diseases such as dysferlinopathy, who we refer to in this Privacy Policy as our “Partners”. For example, we might share with a research institution or a pharmaceutical company aggregated information, such as how many patients reside in a particular country, how many patients have a certain structural mutation, the average age of onset of symptoms for the disease, etc. We will not, however, disclose any of your Personal Data with such Partner without first obtaining your express prior written consent, as discussed further below.

Interactive Community

The other important goal of our Dysferlin Registry Site is to provide a platform for dysferlinopathy patients or, where applicable, their parents, guardians or caregivers who want to communicate with each other about their lives with this disease, including, at their option, by sharing patient health information to build collective knowledge about the disease, health and exercise, daily activities, personal care assistance, potential treatments and other topics of interest to the relevant patient community and, potentially, to our Partners as well to facilitate the development of treatments and cures for LGMD2B and Miyoshi Myopathy. To that end, we provide interactive discussion forums for patients to communicate with each other and a community section that shows the Display Names and photographs of Members who have chosen to participate in the forums and community. We believe that the success in achieving these goals depends on a willingness by our patient community to share information about themselves, their experiences and the various milestones in their lives as openly as possible.

This Policy

We understand, of course, that sharing information about one’s health may not appeal to everyone, and we want to summarize the benefits and risks of being part of such a sharing site, including risks related to privacy.

This Privacy Policy outlines the type of information the Dysferlin Registry Site collects from individuals who have registered to join the site (“Members”) and how it may be shared with other third parties such as Partners. You have the right to clear and transparent communication about how we collect and use such information, and we have strived to make this policy as clear as possible to help you understand it. We welcome any questions or feedback at patients@jain-foundation.org.

We reserve the right to modify this policy at any time. If and when we do so, we will alert you and request that you confirm you have read and agree to the modified policy as a condition to continued participation on the Dysferlin Registry Site. If you do not agree with the terms of this Privacy Policy as amended from time to time, you will remain registered as a patient in our Registry unless you request to be removed, but you will no longer be able to participate on, or have access to, any portion of the Dysferlin Registry Site.

Information We Collect and Restrictions on Its Use and Sharing

The main categories of information and data we collect and address in the Policies are “Personal Data”, “Restricted Data” and “Shared Data”, which may at times overlap with each other. Here is a description of each:

• “Personal Data” is information provided by Members that could identify them. This information might include, for example, your personal name, your date of birth, a photograph of you, your email address, your diagnosis date, your first symptom date and family history, your treatment information and treatment evaluations, your rate of progression and severity, your laboratory results and biomarkers, such as protein levels, enzyme levels and MRI or other images, or your genetic information, such as information on individual gene mutations or entire genetic scans. It would also include your password to enter the site and your mailing address, which is collected as part of your user profile on the site.

We will not share any of your Personal Data with any of our Partners or other third parties without your express prior written consent, unless it is de-identified, at which point it is no longer considered Personal Data. If, however, you share Personal Data on the Dysferlin Registry Site by making it available on a public profile or in a forum discussion, then such Personal Data will be Shared Data that other Members will be able to see.

• “Restricted Data” is Personal Data that you enter into certain fields when registering to use, or when using, the Dysferlin Registry Site. It includes Personal Data you provide through email, private messages or participation in a survey.

Restricted Data will only be shared with employees and consultants of the Jain Foundation. Restricted Data will not be shared with other Members of the Dysferlin Registry Site. If you choose to share any Restricted Data on a public profile or in a forum discussion, however, that information will be treated as Shared Data going forward. If you want all of your Personal Data to remain as Restricted Data, and hence not viewable by any other Member, then you should opt for a private profile by not clicking “List Profile” in your user profile settings, as further described below under the heading “Privacy Settings”.

• “Shared Data” is information about themselves that Members choose to make available for other Members to view, and it might include Personal Data or previously Restricted Data. You may submit Shared Data through your user profile (if you click “List Profile” under the settings), or by entering data in Registry forums. Examples may include a personal photograph and a biographical statement, if you elect to include one in a public profile (which might, at your option, include such items as your gender, age, location, symptoms, interests and hobbies and other general notes), aggregated survey responses, and any other information that you might elect to share via free text fields, such as in Registry forums.

Shared Data may be viewed by any Member, as well as employees and consultants of the Jain Foundation. If any Shared Data is Personal Data, however, we will not make it available to our Partners or other third parties without your express prior written consent.

Members are encouraged to share health information, but should be mindful that as more Personal Data is entered, the more likely it is that a Member could be identified.

How we might use your data

There are instances where your data may be used and disclosed including, but not limited to, the following:

• Jain Foundation uses Shared Data, Restricted Data, and site usage internally, as needed, for research, for maintenance and operation of the Dysferlin Registry Site, and to create the best possible tools and functionality for patients. For example, we might use your Shared Data and Restricted Data internally to determine whether you would be an appropriate participant in one of our surveys or in a clinical trial for an experimental therapy that we have identified, or whether a new approved therapy might benefit you. In such a case we would contact you by private message or email, but of course your decision to participate or not would be voluntary and in your own sole discretion.
• Jain Foundation may use a Member’s data in the case of an emergency or other circumstance that we determine requires the management team to directly contact the Member.
• Jain Foundation may share or disclose a Member’s data where required by law or to comply with legal process.

See also our discussion below under the headings “Your Data Rights” and “The Legal Bases for Our Collection and Use of Personal Data.”

How we might also use Shared Data

The Jain Foundation may report or disclose publicly Shared Data to our Partners, but only in aggregated formats, and we retain the right to receive payment for such disclosure in order to support our charitable mission. An example of such a disclosure might be a report to a hospital or pharmaceutical company listing the number of patients on a particular treatment, the number of patients experiencing a particular symptom, enzyme levels in patients by age group, etc. In addition to serving the individual needs of our Members, the Jain Foundation and our Partners are interested in better understanding the patient experience and improving treatment options and health outcomes for everyone. For example, we may look to answer questions such as, “Do certain treatments work better for some patients than others?”

Jain Foundation may also periodically ask Members to complete short surveys about their experiences (including questions about products and services). Survey responses may be analyzed, combined with Members’ Shared Data and shared with or sold to our Partners, but only on an anonymous basis. Member participation in these surveys is not required, and refusal to do so will not impact a Member’s experience on the Site.

In the future, Jain Foundation might also report individual adverse event and drug safety information to the FDA, CDC, and/or other regulatory bodies (U.S. and international) as well as directly to pharmaceutical and biotechnology companies. Jain Foundation would not provide Restricted Data to such regulatory bodies unless required by law, although we reserve the right to contact Members for follow-up at the request of agencies or Partners. The information Jain Foundation reports includes, but is not limited to, all of the information about the Member and/or free text or images on the forums or evaluations, which may include Shared Data.

How we might also use your Restricted Data

Restricted Data is not automatically shared with, sold to, or displayed for other Members or Partners. Specific instances where Restricted Data may be used, but only if you explicitly ask us to do so and sign an applicable written consent, include, but are not limited to, the following:

• If a Member agrees to participate in a media interview (as arranged by Jain Foundation), Jain Foundation will share the contact information the Member provides (i.e., name, email, telephone) with the reporter for the purpose of conducting an interview;
• If a Member explicitly requests to have their Restricted Data shared with a Partner, Jain Foundation will share the information as instructed and consented to by the Member; and
• If a Member makes a request, Jain Foundation may use Restricted Data, including sharing the Member’s Restricted Data with software/service vendors, for the purpose of fulfilling the request. Examples include requesting to receive a newsletter via email and requesting an email response from the Dysferlin Registry Site support team.

Also, the Dysferlin Registry Site maintains a mailing list. The mailing list includes families of affected individuals, friends, physicians, scientists, contributors and others. The Dysferlin Registry Site will never release the mailing list or the names of our Members’ families to any outside organization or third party unless authorized by the Member or required to do so by law. However, if an outside organization sends us information for distribution to Members of the Dysferlin Registry Site, we may mail it to you after proper approval.

Your Data Rights

All individuals have rights regarding their Personal Data, which, as discussed above, is data that is identified or connected to their identity. The European Union’s (EU) General Data Protection Regulations (GDPR) describes these rights in law, but we believe they should apply to all individuals. They include:

• You have the right to request a copy of your Personal Data in a common digital format. To request this information, please contact us as set forth at the end of these policies.
• You have the right to edit or correct any Personal Data. You can edit most of your information on the site, which we explain in more detail below under the heading “Access to your data in the Registry; Updates”. If you need help, please contact us.
• You have the right to request that your Personal Data be deleted, as described in more detail below under the heading “No obligation to participate in the Registry; Right to withdraw if you change your mind.” To do this, please contact us.
• You have the right to be notified of any breach involving your Personal Data. We will notify the appropriate data protection authority within 72 hours of detecting a breach involving your data. We will notify you as soon as possible after that.
• You have the right to object to the processing of your data. You may decline any consent request to share Personal Data with a Partner, which will have no impact on your use of the Registry. For clarity, we may still share with our Partners “De-Identified Data”, which is information regarding you that does not identify you and is not connected with you. You may withdraw consent at any time, though that will not change any processing that has already occurred or research where analysis has started or is completed. You may also request to close your account at any time, which we describe in more detail below under the heading “No obligation to participate in the Registry; Right to withdraw if you change your mind”.

In some cases, these rights might be restricted. Some examples would include where the information requested compromises the privacy of another individual or is the subject of legal proceedings or investigation. Additionally, processing that has already occurred cannot be undone. Further, these rights to edit, delete, be notified of a breach, and object to processing all apply to Personal Data and do not apply to De-Identified Data that, for example, has been shared by us with our Partners and contractors.

If you have questions or complaints about our handling of these rights, please see the information at the end of this policy.

The Bases for Our Collection and Use of Personal Data

Any processing of your Personal Data will have a basis in law. The GDPR sets out a few possible bases, three of which apply to the Jain Foundation and our Registry.

• As discussed above, we need to use some identifying information to operate the Dysferlin Registry Site, which includes your email address, username, password, and IP address, among other items.
• We may use Personal Data for research with your consent. As explained above, we will always ask for your explicit written consent before sharing Personal Data with our Partners or other third parties.
• In rare cases we might be required to share your identifying data to comply with a legal obligation to a third party.

We believe that all processing of any user’s Personal Data should be for a clear and transparent reason, and we have attempted to explain them to you in this Privacy Policy, but please do not hesitate to contact us with any questions.

Privacy Settings

There are two privacy levels you may choose as a Member of the Dysferlin Registry Site through your user profile:

• Private: If you do not click “List Profile” in your user profile settings, then only employees and consultants of the Jain Foundation will be able to view any information that you provide unless you otherwise consent as described above. We will enter your information into the Registry, but you will not appear as a Member of the Dysferlin Registry Site in the interactive community and you will not be able to participate in the community. You will be able to view the Display Names of other Members of the Dysferlin Registry Site, and you will be able to view messages in the forums, but you will not be able to post messages or reply to messages in the forums. Only the Jain Foundation will be able to contact you through the site.
• Public: If you click “List Profile” in your user profile settings, then other Members will be able to see your Display Name, your biographical statement, if you provide one, and your photograph, if you provide one. All other information on your user profile will remain as Restricted Data unless you share it in a public text field voluntarily. With a public profile, you many participate in the interactive community features of the site, including by posting messages on the forums and reading other Members’ posts. Also, other Members will be able to contact you through the private messaging feature.

Members may change their privacy level at any time. Because the value of the Dysferlin Registry Site is in sharing one’s experiences to help others, we hope that Members feel comfortable enough to make their user profiles as public as possible.

Cookies

A cookie is a data file that often includes an anonymous, unique token, which is sent to your browser from a website’s computers and may be stored on your computer’s hard drive. Two types of cookies are required to use the Dysferlin Registry Site:

• Session Cookies are temporary cookies that remain only until you log out of the website or exit your web browser. Session Cookies do not store any Personal Data, only a unique visitor ID number that may be used to ensure Members are properly authenticated and can view site information.
• Persistent Cookies remain in the cookie file of your browser for much longer, even after you leave the Site. Persistent Cookies also do not store any Personal Data. Persistent Cookies store preferences that should persist from visit to visit, like “Remember Me,” and a unique token to enable us to understand how Members use the site, which we refer to as Site Usage.

Log Files; Web Beacons.

The Dysferlin Registry Site may use log file information sent by your web browser (which may include information such as your web request, Internet Protocol (IP) address, browser type, browser language, referring/exit pages and URLs, platform type, and other information) to analyze trends, administer the site, track the movement of users, and gather broad statistical information for aggregate use. IP addresses are not linked to Personal Data. The Dysferlin Registry Site may also employ “web beacons” (also known as clear gifs) to track online usage patterns of users. This information is not linked to Person Information. Web beacons may also be employed for tracking and receipt purposes in connection with web-based emails we send to users.

Third Party Websites

This Privacy Policy addresses only our use and disclosure of information we collect from and/or about you on the Registry. If you disclose information to others, or authorize us to do the same under this Privacy Policy, the use and disclosure restrictions contained in this Privacy Policy will not apply to any third party except as otherwise described above. We do not control the privacy policies of third parties, and you are subject to the privacy policies of those third parties where applicable. The Registry website may contain content or links to other websites that are not owned or controlled by us. We have no control over, do not review and are not responsible for the privacy policies of or content displayed on such other websites. When you click on such a link, you will leave our Website and go to another site. During this process, another entity may collect personal information or anonymous information from you. The Registry website may also contain links to other websites controlled by us but which operates under different privacy policies. Please review the privacy policy of any new site you visit.

Other Security Issues

Jain Foundation employs independent contractors, vendors and suppliers to provide specific services and products related to the Dysferlin Registry Site or to the services provided on it, including performing general statistical analysis, maintaining an email suppression list as may be required by state and/or federal law, fraud screening, testing and implementation of special services to users, and developing applications for the site and the services provided on it. These outside contractors may have limited access to information collected on the site, including protected health information and personally identifiable information. In the course of providing such products or services, such outside contractors will be contractually obligated to protect the privacy and security of all protected health information and personally identifiable information.

While Jain Foundation takes reasonable precautions to make sure Members are legitimate participants in the Registry, it cannot guarantee the identity of any other Members of the Dysferlin Registry Site with whom any Member may interact in the course of using the site or who may have access to a Member’s Shared Data. Additionally, we cannot guarantee the authenticity of any data that Members may provide about themselves.

We do not delete Personal Data unless requested, as we believe our obligation to provide services continues as long as these diseases exist. Once Member data is aggregated, it cannot be deleted from the aggregated data set.

Members should know that Jain Foundation takes commercially reasonable technical precautions to help keep Member data secure. Members should keep in mind, however, that no internet transmission is ever 100% secure or error-free.

Risks and Benefits

While our goal is to help patients improve health outcomes, there are no certain benefits to participating in the Registry. However, keeping track of personal well-being, treatments, and symptoms has been shown to be helpful in improving overall health.

There are also no known risks to using the Dysferlin Registry Site, but there is a possibility that users may feel uncomfortable sharing information online. It is possible that a Member could be identified using information shared on the site (or in conjunction with other data sources). A Member could be discriminated against or experience repercussions as a result of the information he/she shares. For example, it is possible that employers, insurance companies, or others may discriminate based on health information if it is disclosed.

Members should understand that anyone who registers as a Member at the Dysferlin Registry Site can view the Shared Data in the system. If you have access to the Personal Data of a Member of the Dysferlin Registry Site, you must fulfill your responsibility to protect the privacy of that person.

In using the Dysferlin Registry Site, Members are free to skip any non-required questions or data fields.

Your information may contribute to the development of inventions or commercial products from which others may derive economic benefit. By becoming a Member, you acknowledge and agree that you will have no rights to any inventions, products or other such discoveries and that you will receive no economic benefit from their development or commercialization.

Access to Your Data in the Registry; Updates

You can access and modify or update your personal and medical information. During online registration you will be assigned a personal user account. By logging into your user account, you will be able to securely access certain of your Personal Data stored in the Registry at any time. If you are unable to access such data online, or would like to access your medical records that are stored in the Registry, you can contact us as set forth below. You may also delete, or request the deletion of, any of your Personal Data at any time as described below.

To make sure that the data in the Registry are correct and up-to-date, it is essential that you update it regularly as it changes. We ask you to inform us about any major changes that occur, such as change of address, your participation in a research study or clinical trial, identification of new genetic data or loss of ambulation.

If you cannot update your information online, you can request paper forms where you can tell us about any changes in your medical condition or contact information.

No obligation to participate in the Registry; Right to withdraw if you change your mind

Your participation in the Dysferlin Registry Site and inclusion in the Registry is completely voluntary. You can decide not to participate without having to give any reason. Should you wish to withdraw your data from the Registry, you will be free to do so at any time without having to provide any explanation. If you wish to withdraw, you need to contact us as set forth below. If you withdraw, all your data (identifiable and non- identifiable) will be removed from the Registry except for your anonymous medical data, which will be kept in the Registry for an unlimited period of time, unless you ask us explicitly to withdraw such data as well. We will not, however, be able to recall anonymous data from those with whom it has been shared prior to you request to withdraw.

Governing Law and Members from outside the United States

We and our servers are located in the United States and are subject to the applicable US local and national laws. These laws may not have equivalent privacy protection as those in your country of residence. When we share information about you with our various Partners we use contractual data protection clauses which have been approved by the European Commission.

Those who choose to access the Dysferlin Registry Site do so on their own initiative and understanding that their use of the site and our use of the Shared Data and Restricted Data is subject to EU and US laws and regulations including the General Data Protection Regulation (“GDPR”). If users choose to access or use the Dysferlin Registry Site, they consent to the use and disclosure of information in accordance with this privacy policy and subject to such laws.

GDPR Recourse For Individuals in the EEA

Our representative in the EU for GDPR purposes is: Foley Hoag AARPI. You can contact our representative at:

Foley Hoag AARPI
153 rue du Faubourg Saint-Honoré
75008 Paris, France

If you are a resident of the European Union and have a complaint about our use or processing of your Personal Data, you have a right to lodge a complaint with a national Data Protection Authority. Each European Union member nation has established its own Data Protection Authority; you can find out about the Data Protection Authority in your country.

Questions about the Privacy Policy and related inquiries

If you have questions or comments about our Privacy Policy, or wish to update your information or withdraw from the Dysferlin Registry Site, please contact us by email at patients@jain-foundation.org, or otherwise as follows:

Jain Foundation, Inc.
9706 Fourth Avenue NE
Suite 101
Seattle, WA 98115
Attn: Sarah Shira Emmons
Tel: (425) 882-1492

Effective: November 21, 2018